Netmaker has Insufficient Authorization in Host Token Verification

CAO 8.1CVE-2026-29194 · GHSA-hmqr-wjmj-376c · GO-2026-4655 · Công bố 07/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-29194 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng github.com/gravitl/netmaker, netmaker (gravitl).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.47%, cao hơn 40.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.5.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/gravitl/netmaker Go	`< 1.5.0`	`1.5.0`
netmaker gravitl	`< 1.5.0`	`1.5.0`

Mô tả

The Authorise middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorisation checks without verifying that the host is authorised to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations.

Credits Artem Danilov (Positive Technologies)

Mô tả của NVD

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.